[SOLVED] Checking multiple directories if they are empty. or if they have files inside.

////// · 02-06-2021, 05:56 PM

hello all.

what would be easiest way to check directories if they are empty or if they have file's inside?

Code:

[root@arch /var]# ls /var/log/suricata/filestore
00  0a	14  1e	28  32	3c  46	50  5a	64  6e	78  82	8c  96	a0  aa	b4  be	c8  d2	dc  e6	f0  fa
01  0b	15  1f	29  33	3d  47	51  5b	65  6f	79  83	8d  97	a1  ab	b5  bf	c9  d3	dd  e7	f1  fb
02  0c	16  20	2a  34	3e  48	52  5c	66  70	7a  84	8e  98	a2  ac	b6  c0	ca  d4	de  e8	f2  fc
03  0d	17  21	2b  35	3f  49	53  5d	67  71	7b  85	8f  99	a3  ad	b7  c1	cb  d5	df  e9	f3  fd
04  0e	18  22	2c  36	40  4a	54  5e	68  72	7c  86	90  9a	a4  ae	b8  c2	cc  d6	e0  ea	f4  fe
05  0f	19  23	2d  37	41  4b	55  5f	69  73	7d  87	91  9b	a5  af	b9  c3	cd  d7	e1  eb	f5  ff
06  10	1a  24	2e  38	42  4c	56  60	6a  74	7e  88	92  9c	a6  b0	ba  c4	ce  d8	e2  ec	f6  tmp
07  11	1b  25	2f  39	43  4d	57  61	6b  75	7f  89	93  9d	a7  b1	bb  c5	cf  d9	e3  ed	f7
08  12	1c  26	30  3a	44  4e	58  62	6c  76	80  8a	94  9e	a8  b2	bc  c6	d0  da	e4  ee	f8
09  13	1d  27	31  3b	45  4f	59  63	6d  77	81  8b	95  9f	a9  b3	bd  c7	d1  db	e5  ef	f9

those directories might have files on em. any pointers to right direction are welcomed.

scasey · 02-06-2021, 06:19 PM

How do you know those are directories? Use the -a or -F options to ls for clarity...see the man page.

Also take a look at the man page for find. There may be options there that will answer your question.
Another possibility is the bash test command. Try man test, and if that gives you the bash man page, search tor test.

////// · 02-06-2021, 06:33 PM

Quote:

Originally Posted by scasey

How do you know those are directories?

those are directories created by suricata and those might contain files which are named by their sha256sum, for example if that file name starts with 4fxxxx it is placed to folder 4f.

what i am doing is getting possible malware from my network and uploading it to virustotal, that system is automated, written in perl. i just started writing it and dont want to "invent the wheel again", ill check out what you suggested.

MadeInGermany · 02-06-2021, 07:22 PM

Find empty directories:

Code:

find . -type d -empty

Emerson · 02-06-2021, 07:55 PM

Find and delete.

Code:

find . -empty -type d -delete

computersavvy · 02-07-2021, 02:55 PM

Or if you want only the listing something such as

Code:

for file in `ls /var/log/suricata/filestore`
do
if [ -z $(ls $file) ] 2>/dev/null
then   
   echo "$file is empty
else
   echo "$file has files"
fi

would give you that. The error redirection is necessary if there are multiple files.

MadeInGermany · 02-07-2021, 05:10 PM

Two bugs:

Code:

ls /var/log/suricata/filestore

yields short filenames, and a

Code:

ls $file

looks in the current directory.
Then, it should be

Code:

[ -z "$(ls $file)" ]

to ensure the -z operator gets one argument (operant).
Or take the more robust

Code:

[[ -z $(ls $file) ]]

where no field splitting occurs on the $( ) result.

computersavvy · 02-07-2021, 08:06 PM

He asked for pointers.
Mine works but yours is more elegant and does not necessarily require the redirection. I was looking for a quick way to do what he asked and wrote a quick script that did not use find.

One problem I occasionally have with find even when running as root is the error messages that can be produced and often swamp the actual output, so they have to be gotten rid of as well. For example "find / -name somefilename" may produce a lot of read errors on /proc, /sys, /run, and others, even when run with sudo.

Even with your edits to my test statement it may be necessary to write the $file as "$file" in case the actual directory name contained spaces or shell specific special characters. So the test, to eliminate the short name problem would be more like

Code:

[ -z "$(ls /var/log/suricata/filestore/"$file")" ]

which should then work from anywhere, and if that ls command returned anything it would return false.

MadeInGermany · 02-08-2021, 12:35 AM

Yes, the $file should be in quotes as well.
Another idea: a glob gives pathnames, and a trailing / even restricts the match to directories i.e. omits files

Code:

for dir in /var/log/suricata/filestore/*/
do
  if [ -z "$(ls "$dir" 2>/dev/null)" ]
  then   
    echo "$dir is empty
  else
    echo "$dir has files"
  fi
done

////// · 02-08-2021, 10:46 AM

thanks for the help guys.
i managed to write it in Perl.